#!/usr/bin/env python

""" Example for integrate with malware domains """

__author__ = "Luis Campo Giralte"
__copyright__ = "Copyright (C) 2013-2020 by Luis Campo Giralte"
__revision__ = "$Id$"
__version__ = "0.1"

import sys
sys.path.append("../src/")
import pyaiengine

def callback_domain(flow):

    d = flow.dns_info
    if (d):
        print("Malware on ip:%s domain:%s" % (flow.src_ip,d.domain_name)) 

def loadBadDomains():

    dm = pyaiengine.DomainNameManager()

    # List from http://www.malwaredomainlist.com/hostslist/hosts.txt
    # Or https://zeustracker.abuse.ch/blocklist.php?download=baddomains for ZeusDomains
    # Parse the file and add the domains.
    f = open("zeus.dat","r")

    lines = f.readlines()
    i = 0
    for line in lines:
        if( line[0] != "#"):
            domain = line.replace("\r\n","").split(" ")
            if(len(domain)> 2):
                name = "Bad domain %d" % i
                i = i +1
                dom = pyaiengine.DomainName(name,domain[2])
                dom.callback = callback_domain

                dm.add_domain_name(dom)
    f.close()
    return dm

if __name__ == '__main__':

     # Load an instance of a Network Stack on Mobile network (GN interface)
     st = pyaiengine.StackMobile()

     doms = loadBadDomains()
     st.set_domain_name_manager(doms,"DNSProtocol")

     # 1.638.400 UDP flows will be enough?
     st.udp_flows = 1638400

     with pyaiengine.PacketDispatcher("eth0") as pd:
         pd.stack = st
         pd.run()
     
     sys.exit(0)
